Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
(browse all)
Permalink CVE-2023-6395
created 4 months, 3 weeks ago
Mock: privilege escalation for users that can access mock configuration

The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.

Affected products

mock

Matching in nixpkgs

pkgs.cmocka

Lightweight library to simplify and generalize unit tests for C

  • nixos-unstable -

pkgs.mockgen

Mocking framework for the Go programming language

  • nixos-unstable -

pkgs.mockoon

Easiest and quickest way to run mock APIs locally

  • nixos-unstable -

pkgs.umockdev

Mock hardware devices for creating unit tests

  • nixos-unstable -

pkgs.wiremock

Flexible tool for building mock APIs

  • nixos-unstable -

pkgs.uhttpmock

Project for mocking web service APIs which use HTTP or HTTPS

  • nixos-unstable -

pkgs.go-mockery

Mock code autogenerator for Golang

  • nixos-unstable -

pkgs.go-minimock

Golang mock generator from interfaces

  • nixos-unstable -

pkgs.mockobjects

Generic unit testing framework and methodology for testing any kind of code

  • nixos-unstable -

pkgs.libqtdbusmock

Library for mocking DBus interactions using Qt

  • nixos-unstable -

pkgs.uhttpmock_1_0

Project for mocking web service APIs which use HTTP or HTTPS

  • nixos-unstable -

pkgs.gnomeExtensions.mock-tray

Creates an invisible system tray (TopIcons) for apps (like MEGAsync) that won't run properly without one.

  • nixos-unstable -
    • nixpkgs-unstable 4

Package maintainers